General Data Protection Regulation
Requesting Your Personal Data From Think Comms LTD
Under General Data Protection Regulation (GDPR), you have the right to access your personal data held by Think Comms. This is known as a Subject Access Request (SAR). The process is set out below:
Subject Access Request
You can make a SAR to receive your own personal data, or a third party can make a SAR for you, with proof that you have been given permission.
As an O2 Business customer, you will be able to access your bills online at My O2, or you can request copies through our Customer Service team.
Only information considered to be your personal data will be released under a SAR. We are unable to provide:
- The phone numbers of calls or texts you’ve received (see Requesting call records via a solicitor).
- The content of text messages or personal phone calls.
- Numbers, photos, video clips or text messages stored on your phone.
To make a valid SAR, you must:
Put your request in writing to Think Comms Limited (postal address below). To speed up the process you should complete the Subject Access Request Form.
Under GDPR Think Comms will not charge an initial admin fee, however, should a request be manifestly unfounded, excessive or repetitive then a reasonable charge may occur to cover administrative costs.
Send your completed form and proof of identity and ownership to:
GDPR Think Comms Limited 54a High Street, Fareham, Hampshire, PO16 7BG
The more specific the more information you provide, the quicker we’ll be able to respond.
We’ll respond to your request without delay and within one month of receipt in most circumstances, however, should an extension be necessary we will notify you within one month explaining why.
Requesting call records via a solicitor
Due to Think Comms not holding network related personal information, If outgoing data is required and your client is a Pay Monthly customer please see Requesting your personal data from O2 here.
Right to be forgotten
What is the right to erasure?
Under Article 17 of the GDPR individuals have the right to have personal data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.
Individuals have the right to have their personal data erased if:
- Personal data is no longer necessary for the purpose which it was originally collected or processed it for
- The individual withdraws their consent
- The individual objects to the processing of their data and there is no overriding legitimate interest to continue the processing
- The processing of the personal data is for direct marketing purposes and the individual objects to that processing
- Personal data was unlawfully processed
- It is a legal obligation.
When does the right to erasure not apply?
The right to erasure does not apply if processing is necessary for one of the following reasons:
- When exercising the right of freedom of expression and information
- Complying with a legal obligation
- The performance of a task carried out in the public interest or in the exercise of official authority
- Archiving purposes in the public interest, scientific research historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing; or
- For the establishment, exercise or defence of legal claims.
The GDPR also specifies two circumstances where the right to erasure will not apply to special category data:
- If the processing is necessary for public health purposes in the public interest (eg protecting against serious cross-border threats to health, or ensuring high standards of quality and safety of healthcare and of medicinal products or medical devices) or
- If the processing is necessary for the purposes of preventative or occupational medicine (eg where the processing is necessary for the working capacity of an employee; for medical diagnosis; for the provision of health or social care; or for the management of health or social care systems or services). This only applies where the data is being processed by or under the responsibility of a professional subject to a legal obligation of professional secrecy (eg a health professional).
Think Comms do not hold or process special category data.
Right to be forgotten request
As highlighted above, please put your request in writing to Think Comms Limited (postal address below).
We will not charge an initial admin fee, however, should a request be manifestly unfounded, excessive or repetitive then a reasonable charge may occur to cover administrative costs.
Please send your request and proof of identity and ownership to:
GDPR Think Comms Limited 54a High Street, Fareham, Hampshire, PO16 7BG